Error Handling

Question 1

Testing for Error Codes

Answer 1

These codes reveal a lot of information about databases, bugs, and other technological components directly linked with web applications.

Approach
	- Google hacking 
		○ Locate errors that disclose information
	- Send custom requests to web server
		○ Force specific errors types

Error Types

- Web Server Errors
- Application Server Errors
- Database Errors

Remediation
- Remove the server information from the error responses

Question 2

Web Server Errors

Answer 2

Can provide useful information like:

• OS
• Apache version
• PHP version
• OpenSSL version

HTTP Error Codes

- 400
- 404
- 408
- 501
- 505

Question 3

HTTP Status Code:

400 Bad Request

Answer 3

The request could not be understood by the server due to invalid syntax.

The client SHOULD NOT repeat the request without modifications.

Question 4

HTTP Status Code:

404 Not Found

Answer 4

The server has not found anything matching the Request-URI.

No indication is given of whether the condition is temporary or permanent.

This status code is commonly used when the server does not wish to reveal exactly why the request has been refused, or when no other response is applicable.

In the browser, this means the URL is not recognized.

In an API, this can also mean that the endpoint is valid but the resource itself does not exist.

Question 5

HTTP Status Code:

408 Request Timeout

Answer 5

The client did not produce a request within the time that the server was prepared to wait.

It means that the server would like to shut down this unused connection.

The client MAY repeat the request without modifications at any later time.

Also, note that some servers merely shut down the connection without sending this message.

Question 6

HTTP Status Code:

501 Not Implemented

Answer 6

The server does not support the functionality required to fulfill the request.

The request method is not supported by the server and cannot be handled.

The only methods that servers are required to support (and therefore that must not return this code) are GET and HEAD.

Question 7

HTTP Status Code:

505 HTTP Version Not Supported

Answer 7

The HTTP version used in the request is not supported by the server.

The response SHOULD contain an entity describing why that version is not supported and what other protocols are supported by that server.

Question 8

Application Server Errors

Answer 8

Errors returned by the application itself.

Can provide server paths, installed libraries, and application versions.

Question 9

Database Errors

Answer 9

Errors returned by the Database System when there is a problem with the query or the connection.

Can provide Database server IPs, tables, columns, and login details.

Question 10

Testing for Stack Traces

Answer 10

The stack trace is a list of the functions in the call stack at the point an exception is triggered.

The stack trace reveals sensitive information.

Attackers attempt to generate these stack traces by tampering with the input to the web application with malformed HTTP requests and other input data.